token-2022-extensions

name	token-2022-extensions
description	Trigger Pattern TOKEN_2022 flag detected (token_2022/spl_token_2022/transfer_checked usage) - Inject Into Breadth agents, depth agents

TOKEN_2022_EXTENSIONS Skill

Trigger Pattern: TOKEN_2022 flag detected (token_2022/spl_token_2022/transfer_checked usage) Inject Into: Breadth agents, depth agents Finding prefix: [T22-N] Rules referenced: S9, R3, R11

For every token mint the program interacts with that may use Token-2022:

1. Extension Inventory

For each mint:

Mint	Token Program	Extensions Detected	Extension Impact
{mint}	token / token-2022	{list: TransferFee, TransferHook, PermanentDelegate, MintCloseAuthority, DefaultAccountState, etc.}	{brief per-extension impact}

Detection: Check if program uses spl_token_2022 or token_2022 imports. Check mint account data length (Token-2022 mints are larger due to extension data).

2. Extension Allowlist

Does the program explicitly check which extensions are supported?

Check	Present?	Location	Missing Extensions Handled?
Extension allowlist / blocklist	YES/NO	{line}	{what happens with unsupported extension}

Attack (S9): Program designed for basic SPL Token interacts with Token-2022 mint that has unexpected extensions (e.g., PermanentDelegate). Program doesn't check → extension silently affects behavior. Defense: Explicitly check mint extensions and reject unsupported ones.

3. Permanent Delegate Risk

For each mint with PermanentDelegate extension:

Mint	Permanent Delegate	Trust Level	Vault Drain Scenario	Mitigation
{mint}	{delegate pubkey}	{trusted/untrusted/unknown}	{can delegate drain vault?}	{what prevents it}

Attack: Permanent delegate can transfer tokens FROM any token account of that mint, without the account owner's approval. If protocol holds tokens of a PermanentDelegate mint → delegate can drain them at any time.

4. Transfer Hook Analysis

For each mint with TransferHook extension:

Mint	Hook Program	Hook Verified?	CU Budget Impact	Recursion Risk?
{mint}	{program_id}	YES/NO	{estimated CU}	YES/NO

Risks:

• Hook program can consume significant CU, causing transactions to fail
• Hook program can revert, blocking all transfers of this token
• Hook program may have its own CPI chain, adding depth
• Hook may read additional accounts not provided by the caller

5. Transfer Fee Accounting

For each mint with TransferFeeConfig:

Mint	Fee Rate	Fee Accounted in Protocol Math?	Amount Received < Amount Sent?
{mint}	{bps}	YES/NO	{if NO: accounting mismatch}

Attack: Protocol calculates expected amounts without deducting transfer fee → accounting mismatch, potential insolvency. Pattern: transfer_checked returns the gross amount. The net amount received is gross - fee. Protocol must use net amount in accounting.

6. CPI Guard Handling

For transfers through delegation (CPI transfers):

Transfer Type	Uses CPI?	CPI Guard Enabled on Mint?	Transfer Works?
{type}	YES/NO	YES/NO/Unknown	{if CPI Guard + delegation: may fail}

CPI Guard: When enabled, prevents token account delegates from transferring via CPI. Programs that rely on delegated transfers via CPI will fail silently.

7. Default Account State

For mints with DefaultAccountState extension:

Mint	Default State	Protocol Handles Frozen?	Impact
{mint}	Frozen / Initialized	YES/NO	{if frozen: new token accounts start frozen, need thaw}

8. Mint Existence Verification (MintCloseAuthority)

For mints with MintCloseAuthority extension:

Mint	Close Authority	Checked Before Read?	Impact if Mint Closed
{mint}	{authority}	YES/NO	{if NO: reading zeroed data, incorrect decimals/supply}

Attack: Mint with MintCloseAuthority can be closed (if supply == 0). Protocol reads closed mint → gets zeroed data → decimals = 0, incorrect calculations.

Finding Template

**ID**: [T22-N]
**Severity**: [PermanentDelegate drain = Critical, transfer fee mismatch = High, CPI Guard = Medium]
**Step Execution**: ✓1,2,3,4,5,6,7,8 | ✗(reasons) | ?(uncertain)
**Rules Applied**: [S9:✓, R3:✓, R11:✓/✗]
**Location**: program/src/{file}.rs:LineN
**Title**: Token-2022 [extension] in [context] enables [attack]
**Description**: [Specific extension vulnerability with data flow]
**Impact**: [Fund drain / accounting mismatch / DoS]

---

Step Execution Checklist (MANDATORY)

Section	Required	Completed?	Notes
1. Extension Inventory	YES	✓/✗/?	For every mint
2. Extension Allowlist	YES	✓/✗/?	Explicit check present?
3. Permanent Delegate Risk	IF PermanentDelegate	✓/✗(N/A)/?	Vault drain scenario
4. Transfer Hook Analysis	IF TransferHook	✓/✗(N/A)/?	CU + revert risk
5. Transfer Fee Accounting	IF TransferFee	✓/✗(N/A)/?	Net vs gross
6. CPI Guard Handling	IF delegated CPI transfers	✓/✗(N/A)/?	Delegation + CPI Guard
7. Default Account State	IF DefaultAccountState	✓/✗(N/A)/?	Frozen by default
8. Mint Existence Verification	IF MintCloseAuthority	✓/✗(N/A)/?	Closed mint reads